Make sure SAML requests always ask for email format NameID (#31008)

#30978

ee/server/service/mdm.go

@@ -15,7 +15,6 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/crewjam/saml"
 	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/authz"
@@ -721,8 +720,6 @@ func (svc *Service) InitiateMDMAppleSSO(ctx context.Context, initiator string) (
 	if err != nil {
 		return "", 0, "", ctxerr.Wrap(ctx, err, "failed to create provider from metadata")
 	}
-	// Request the NameID as an email address instead of an unknown type
-	samlProvider.AuthnNameIDFormat = saml.EmailAddressNameIDFormat
 
 	// originalURL is unused in the Setup Experience initiated MDM flow
 	// however because we need slightly different behavior for account driven

ee/server/service/users.go

@@ -22,7 +22,7 @@ func (svc *Service) GetSSOUser(ctx context.Context, auth fleet.Auth) (*fleet.Use
 	// email, we do it here to avoid hitting the database early if
 	// the email happens to be invalid.
 	if err := fleet.ValidateEmail(auth.UserID()); err != nil {
-		return nil, ctxerr.New(ctx, "validating SSO response")
+		return nil, ctxerr.Wrap(ctx, err, "validating SSO response email")
 	}
 
 	user, err := svc.Service.GetSSOUser(ctx, auth)

server/sso/authorization_request_test.go

@@ -61,6 +61,7 @@ func TestCreateAuthorizationRequest(t *testing.T) {
 	authReq := inflate(t, encoded)
 	assert.Equal(t, "issuer", authReq.Issuer.Value)
 	assert.Equal(t, "Fleet", authReq.ProviderName)
+	assert.Equal(t, string(saml.EmailAddressNameIDFormat), authReq.NameIDPolicy.Element().Attr[0].Value)
 	assert.True(t, strings.HasPrefix(authReq.ID, "id"), authReq.ID)
 
 	ssn := store.session

server/sso/saml_provider.go

@@ -48,9 +48,10 @@ func SAMLProviderFromConfiguredMetadata(
 		return nil, ctxerr.Wrap(ctx, err, "failed to parse ACS URL")
 	}
 	return &saml.ServiceProvider{
-		EntityID:    entityID,
-		AcsURL:      *parsedACSURL,
-		IDPMetadata: entityDescriptor,
+		EntityID:          entityID,
+		AcsURL:            *parsedACSURL,
+		IDPMetadata:       entityDescriptor,
+		AuthnNameIDFormat: saml.EmailAddressNameIDFormat,
 	}, nil
 }